{
 "slug": "address-poisoning-50m-usdt-dec-2025",
 "title": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
 "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025",
 "json": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "ethereum"
 ],
 "method": "address-poisoning",
 "product": "Ethereum USDT holder (funds withdrawn from Binance)",
 "tags": [
  "ethereum",
  "address-poisoning",
  "usdt",
  "test-transaction",
  "lookalike-address",
  "tornado-cash",
  "binance-withdrawal"
 ],
 "amountUsd": 49999950,
 "victims": 1,
 "startedAt": "2025-12-20",
 "closedAt": "2025-12-20",
 "updatedAt": "2025-12-20T12:00:00Z",
 "summary": "On 20 December 2025 a trader sent a 50 USDT test to the correct address, then 26 minutes later sent 49,999,950 USDT on Ethereum to a lookalike address the attacker had planted in their transaction history. The fake matched the first five and last four characters of the real address. Within 30 minutes the funds were swapped to DAI, then to about 16,690 ETH, and almost all of it went into Tornado Cash. Always check the full address, not just the start and end.",
 "timeline": [
  {
   "date": "2025-12-20",
   "title": "At 03:06 UTC the victim sent a 50 USDT test to the intended address; a script then created a lookalike address and sent small transfers to poison the wallet's history.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return"
  },
  {
   "date": "2025-12-20",
   "title": "At 03:32 UTC the victim copied the lookalike address from history and sent 49,999,950 USDT to it.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return"
  },
  {
   "date": "2025-12-20",
   "title": "Within 30 minutes the USDT was swapped to DAI via MetaMask Swap, converted to about 16,690 ETH, and about 16,680 ETH was deposited into Tornado Cash.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return"
  },
  {
   "date": "2025-12-20",
   "title": "The victim posted an on-chain message offering a $1M bounty for return of 98% of the funds and said a criminal case had been filed.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Crypto trader loses $50 million in address poisoning attack, offers $1 million bounty for return",
   "url": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "publisher": "The Block",
   "date": "2025-12-20"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nYou are at risk if you copy recipient addresses from your wallet's recent activity or a block explorer. Tiny or zero-value transfers from addresses that look almost identical to ones you pay often are the poisoning step.\n\n## What to do now\n- If you just sent funds to the wrong address, act within minutes: if the funds are still USDT or USDC, ask the issuer (Tether or Circle) to freeze them, and report to your exchange, the police and a security responder such as SEAL 911.\n- Hide or ignore dust and zero-value transfers in your wallet.\n\n## How to avoid this\n- Never copy a recipient from transaction history. Use a saved address-book entry or copy from the original source.\n- Compare the whole address, character by character, or use ENS names and withdrawal whitelists.\n- A test transaction only helps if the main transfer goes to the same, re-checked address.\n- Keep your wallet's lookalike-address warnings switched on.",
 "notes": null,
 "agentBrief": "# Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history\n\n- Severity: Critical · Status: Still active (past)\n- Chains: Ethereum · Method: Address poisoning\n- Started: Dec 20, 2025 · Last update: Dec 20, 2025 · Reported stolen: $50M · Victims: 1\n- Who/what: Ethereum USDT holder (funds withdrawn from Binance)\n\nOn 20 December 2025 a trader sent a 50 USDT test to the correct address, then 26 minutes later sent 49,999,950 USDT on Ethereum to a lookalike address the attacker had planted in their transaction history. The fake matched the first five and last four characters of the real address. Within 30 minutes the funds were swapped to DAI, then to about 16,690 ETH, and almost all of it went into Tornado Cash. Always check the full address, not just the start and end.\n\n## Am I affected?\nYou are at risk if you copy recipient addresses from your wallet's recent activity or a block explorer. Tiny or zero-value transfers from addresses that look almost identical to ones you pay often are the poisoning step.\n\n## What to do now\n- If you just sent funds to the wrong address, act within minutes: if the funds are still USDT or USDC, ask the issuer (Tether or Circle) to freeze them, and report to your exchange, the police and a security responder such as SEAL 911.\n- Hide or ignore dust and zero-value transfers in your wallet.\n\n## How to avoid this\n- Never copy a recipient from transaction history. Use a saved address-book entry or copy from the original source.\n- Compare the whole address, character by character, or use ENS names and withdrawal whitelists.\n- A test transaction only helps if the main transfer goes to the same, re-checked address.\n- Keep your wallet's lookalike-address warnings switched on.\n\n## Sources\n- Crypto trader loses $50 million in address poisoning attack, offers $1 million bounty for return (The Block, 2025-12-20): https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return\n\nFull record: https://drains.watch/i/address-poisoning-50m-usdt-dec-2025 · JSON: https://drains.watch/i/address-poisoning-50m-usdt-dec-2025.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}